'Henry VIII' clauses threaten to derail data reform bill

Privacy campaigners have issued a stern warning to ministers that the Data (Use & Access) Bill could trigger a widespread abuse of data laws by future governments, in what they have dubbed “Henry VIII” clauses.

The move, which threatens to delay the passage of the Data Bill through Parliament, highlights that these clauses are delegated legislative powers that allow the Government to override or amend primary legislation as it was enacted by Parliament; the Data Bill makes extensive use of them.

The Open Rights Group argues if the Data Bill were to be approved as it is, it would provide 87 such clauses that the Government and its ministers could use to modify key aspects of UK data protection law via Statutory Instrument – no SI has been rejected by the House of Commons since 1979.

This, the group argues, would allow governments to change primary legislation according to the politics of the day, undermining trust in digital verification services and endangering democratic safeguards.

It would also introduce significant risks for the retaining of the UK adequacy status with the EU. If these powers were to be used, at any time, to authorise personal data transfers to a country that does not enjoy adequacy status from the EU, or to restrict the definition of special category data, this would guarantee the revocation or annulment of the UK adequacy status.

Another area of concern is that ministers could require at their sole discretion disclosure of sensitive characteristics such as gender, ethnicity or health conditions. This would enable the Department of Work & Pensions, the Home Office or HMRC to run background checks on any kind of information or attribute held by public bodies or digital verification service providers.

The powers could also be used to undermine the integrity of general elections, the group argues, maintaining that any party in power could change the rules around how electoral data is used just months before an election takes place.

Opposition parties might worry Labour (whose election database runs on Experian, the credit agency servers) might use these powers to self-preference themselves and obtain even more access to commercial data.

The Open Rights Group concluded: “Henry VIII clauses introduce unacceptable risks, and are being introduced in the absence of a meaningful justification.

“The Government has generally argued that these powers would allow ministers to update the law and to adapt it to technological progress. This statement does not hold to scrutiny: the UK GDPR is already principle based and allows both the ICO and the Court System to adapt the interpretation of UK data protection law to a changing reality.

“Independent regulators and courts are better suited than the government at doing that, since they are independent and non-partisan. Further, Henry VIII clauses allow ministers to override primary legislation: the stated intent of using such a wide-ranging power to merely update legal provisions is suspicious and should be rejected as an unacceptable attempt to interfere with the role of Parliament.

“We recommend MPs to reject Clauses 70, 71, 74, 80, 85 and Schedule 7. Further, we recommend MPs to bring Clauses 28, 29, 34 and 45 back to the drawing board in order to introduce meaningful limits to the government discretion when regulating DVS providers.”